feat(ux): vendor CodeMirror instead of loading from esm.sh CDN

[AbstractNucleus]

What: CodeMirror is loaded from esm.sh at runtime in the file editor view.

Why: Runtime CDN dependency — app breaks if esm.sh is down, and operators on isolated networks can't run the panel at all.

Approach: Vendor CodeMirror modules into static/vendor/codemirror/ (use npm or uv tool run-style fetch in a build step). Update <script type="module"> to point at local paths.

[AbstractNucleus]

This was generated by AI during triage.

Routed to ready-for-human — vendoring CodeMirror introduces a build/asset-pipeline decision the project doesn't currently have:

• Add package.json + npm to the toolchain? (drag for a Python-only project)
• Or fetch tarballs via a uv run script at build time?
• Or commit pre-built bundles to static/vendor/?

Each option is reasonable; the choice shapes everything downstream.